CVE-2026-25861: QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php

Synopsis

Weak password hashing using MD5 in QloApps through version 1.7.0 exposes stored user credentials to offline brute-force attacks. The vulnerability is reachable over the network without any authentication, and an attacker who obtains the password hash database can crack credentials offline. Successful exploitation gives the attacker plaintext user passwords, enabling account takeover. No official fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the QloApps service over the network to obtain or interact with stored MD5 password hashes.

• AuthenticationNot required

  No credentials are needed; the attacker can target the hashing weakness without an existing account.

• Victim interactionNot required

  No user action is needed; the attacker works offline against previously obtained hashes.

• Attack complexityDetail

  Attack complexity is high due to environmental factors such as needing access to the hash database, though once hashes are obtained, the weak MD5 algorithm makes cracking straightforward, especially against the auto-generated 8-character passwords.

Blast Radius

• Attacker recovers plaintext passwords for registered users and guest-converted customer accounts from the MD5 hash database.
• Recovered credentials enable full account takeover, exposing stored personal data, booking history, and payment references tied to each account.
• Auto-generated 8-character passwords assigned during guest-to-customer conversion are trivially cracked, widening the pool of compromised accounts.